Fix reflected XSS by HTML-encoding 'asdf' GET parameter in action.php

[zeropath-ai-staging]

This reflected cross-site scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in a victim's browser, potentially leading to session hijacking or malicious actions performed on the user's behalf. The action.php script directly echoes the unsanitized $_GET['asdf'] parameter (lines 16-17) into the HTTP response, which causes any injected HTML or JavaScript code provided in the URL to be immediately executed. Because the input is reflected without any validation or encoding, an attacker can craft a malicious URL to compromise users.